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(57) Abstract 

A method and apparatus for gener- 
ating a message authentication code (mac) 
or integrity check value (icv) for a digi- 
tal message to be transmitted by way of 
a telecommunications medium. Modular 
arithmetic to a prime modulus is utilised to 
combine message data and pseudo-random 
cipher data so as to produce a mac or icv 
which has a cryptographic strength compa- 
rable to that of the source of cipher data. 
The method for generating the mac can 
be performed iterarively, this being suit- 
able for use with stream cipher encryption 
methods. 
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A METHOD AND APPARATUS FOR GENERATING A DIGITAL MESSAGE 

AUTHENTICATION CODE 



5 This invention relates to a method and apparatus for generating a digital message 

authentication code. 

In digital communication systems, such as broadband integrated systems digital 
networks (B-ISDN) it is often desirable to prevent the meaning of digital messages 

10 transmitted thereon from being intercepted and/or interfered with by an unauthorised 
person. For this reason, digital messages are often encrypted or enciphered such that a 
person intercepting the transmitted message is unable to ascertain its meaning. Therefore, 
at the sending site on the network a plain text message is, under control of an enciphering 
key, transformed into cipher text which is preferably unintelligible to anyone not having 

15 the secret deciphering key. At the legitimate receiving site on the network, the cipher 
text is, under control of the secret deciphering key, retransformed into the original plain 
text message. Cryptographic systems which operate in this way are commonly classified 
into block ciphers and stream ciphers. 

20 Stream ciphers act by dividing the plain text into characters, each of which is 

enciphered utilising a time varying function whose time dependency is governed by the 
internal state of the stream cipher. The time varying function is produced by a cipher 
stream generator, which generates a digital cipher stream in accordance with key data 
which is kept secret. The cipher stream generator is constructed such that the cipher 

25 stream produced is a pseudo random bit stream which is cyclic, but has a period which 
is much greater than the length of key data provided. In a stream cipher, after each 
character is enciphered, the device changes state according to a rule, such that two 
occurrences of the same character in the plain text message will usually not result in the 
same cipher text character. 

30 

The security or strength of a stream cipher depends on the "randomness" of the 
generated cipher stream. Assuming an interceptor has knowledge of the plain text 
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message, full access to the running cipher stream may also be deduced. For the system 
to be secure, the cipher stream must be unpredictable: regardless of the number of cipher 
stream digits observed, the subsequent cipher stream digits must not be more easily 
predictable than by just randomly guessing them. An enciphering system such as this 
5 ensures that an unauthorised person is unable to determine the meaning of an intercepted 
message, but does not address the issue of interference with the message despite its 
meaning being unknown. For example, a portion of a transmitted message may be 
intercepted altered or replaced with another message portion even if the interceptor is 
unable to ascertain the deciphered meaning of the original, altered or replaced message 
10 portion. 

The immunity of a system to unauthorised and undetected alteration of a 
transmitted message is referred to as the integrity of the system. Integrity is a factor 
which is not often considered in relation to stream ciphers. A message authentication 

15 code (mac), or integrity check value (icv) determined from the content of the plain text 
message, may be transmitted with the cipher text to enable the receiver to determine 
whether the received deciphered plain text corresponds with the plain text originally 
transmitted, i.e. whether the cipher text has been altered during transmission. The 
message deciphering and authentication process involves the receiver having access to a 

20 cipher stream corresponding to the cipher stream with which the message was enciphered. 
Then, upon receiving the message the receiver can decipher it and generate a mac from 
the deciphered plain text message. A comparison of the received mac and the mac 
generated by the receiver can then be used as an indication of whether the transmitted 
mac or message has been altered in transit, since the mac generated by the receiver 

25 should be the same as the mac generated at the transmitter. However, in certain 
cryptographic systems it may be possible for a cryptanalyst to alter both the cipher text 
message and the enciphered mac in such a way that the change is not apparent to the 
receiver, even though the cryptanalyst is unable to determine the meaning of the cipher 
text which has been altered. Therefore, it is also advantageous for cryptographic systems 

30 to provide an integrity checking or authentication process which prevents such alterations 
during transmission from taking place without detection. 



WO 94/21066 



94/00101 



- 3 - 

A paper entitled "A Fast Cryptographic Checksum Algorithm Based on Stream 
Ciphers" (X. Lai, R. Reuppel, J. Woollven; AUSCRYPT *92 Abstracts; pp 8-7 to 8-11) 
describes a cryptographic checksum algorithm for producing a message authentication 
code with a stream cipher system. The checksum algorithm presented involves 
5 demultiplexing the message stream into two subsequences according to the binary state 
of the cipher stream. The two subsequences are input to respective accumulating 
feedback shift registers, the outputs of which serve as a pair of message authentication 
codes. The checksum algorithm is easily implemented, regardless of the cipher stream 
generator structure. However, the cryptographic checksum algorithm is flawed in so far 
10 as the alteration of a single digit in the message stream only requires the alteration of a 
single digit in the message authentication code to obtain the correct mac value. 
Consequently, certain alterations can be made to the message with a high probability of 
also obtaining the correct message authentication code. 

15 A further integrity checking system is described in International Patent Application 

No. PCT/AU93/00687 entitled "A method and apparatus for generating a cipher stream". 
The algorithms described therein for generating message authentication codes, however, 
are dependent upon the particular structure of the cipher stream generator. It would be 
preferable, therefore to provide an integrity checking mechanism for a stream cipher 

20 system which is independent from the method used for generating the stream cipher itself. 

In accordance with the present invention there is provided a method for generating 
a message authentication code for a digital message in a telecommunications or computer 
system comprising: 
25 generating a sequence of pseudo random cipher strings; and 

generating a message authentication code by performing modular arithmetic to a 
prime modulus including multiplication of the digital message by a first said cipher string 
and addition of a second said cipher string. 

30 Preferably, the message comprises a sequence of message units which are 

multiplied by respective powers of said first cipher string in generating the message 
authentication code. 
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Preferably, the message comprises a sequence of message blocks each comprising 
a said sequence of message units, each sequence of message units being multiplied by 
respective different said first cipher strings and summed with said second cipher string 
to form the message authentication code. 

5 

In accordance with the present invention there is also provided a method for 
generating a message authentication code in a telecommunications or computer system 
for a digital message which comprises a sequence of message blocks each comprising a 
sequence of message units, including the steps of: 
10 generating a sequence of pseudo random cipher strings; 

generating a non-linear function value for each message block by summing the 
constituent message units multiplied by respective values derived from said cipher string 
sequence; and 

generating the message authentication code by summing the non-linear function 
15 values with a said cipher string sequence value to a prime modulus. 

Preferably the message units are multiplied by respective powers of a said cipher 
string sequence value. 

20 In accordance with the present invention there is also provided a method for 

generating a message authentication code in a telecommunications or computer system 
for a digital message M which comprises a sequence of message units for j=0, 1, 
r, comprising the steps of: 

generating a sequence of pseudo random cipher strings Zj; 

25 determining a non-linear function value f according to 

r 

f (Mz) = J3 m /i ~ X ( mod />); and 

Jt-O 

generating the message authentication code Q modulus p, where p is prime, 
according to 
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Q = <AMx) + z 1+1 ) (mod p) 

In accordance with the present invention there is also provided a method for 
generating a message authentication code in a telecommunications or computer system 
for a digital message M which comprises a sequence of message units n^ for j=0, 1, 
r, comprising the steps of: 
5 generating a sequence of pseudo random cipher strings Zjj 

determining a non-linear function value f according to 

r 

AMf) = £ mjL x (mod /?); and 

jr-0 

generating the message authentication code Q modulus p, where p is prime, 
according to 



10 In accordance with the present invention there is also provided a method for 

generating a message authentication code in a telecommunications or computer system 
for a digital message M which comprises a sequence of message blocks for j=0, 1, 
s, each message block comprising a sequence of b message units nij k for k=0, 1, b— 1, 
comprising the steps of: 

15 generating a sequence of cipher strings Zj, z^ lt z^ 2 • • • 

determining a non-linear function value f for each message block according to 

6-1 

AM p z) = £ m jx z ' ( mod P)> 

generating the message authentication code Q modulus p, where p is prime, 
according to 

QiM^) = (£ AM^J + Wl ) (mod p). 

jr-0 



20 



Preferably the message authentication code effective code size is increased by a 
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factor of h by generating a modified message authentication code Q 1 according to: 

<?' = Q(M*) | «Af^. +x+2 ) | QiM^J 

| QW^i^^ (mod p) 
where \ represents concatenation. 

The present invention further provides a method for encoding a digital message 
comprising generating a sequence of cipher strings, generating a message authentication 
5 code according to a method described above, enciphering the message by combining at 
least one said cipher string therewith, the at least one cipher string being distinct from 
the cipher strings utilised for generating the message authentication code, and appending 
the message authentication code to the enciphered message. 

10 The invention also provides apparatus for generating a message authentication 

code for a digital message composed of a sequence of message blocks, comprising: 

a stream cipher for generating a sequence of pseudo-random cipher strings; and 
computation means for generating a non-linear function value for each message 
block by combining each message block with at least one said cipher string by way of 
15 modular arithmetic to a prime modulus, and generating a message authentication code by 
summing the non-linear function values together with at least one further said cipher 
string. 

Preferred embodiments of the invention are described in detail hereinafter, by way 
20 of example only, with reference to the accompanying drawings, wherein: 

Figure 1 is a flow chart of a preferred algorithm for generating a message 
authentication code; and 

Figure 2 is a block diagram of a system for encoding digital messages for 
transmission by way of a telecommunications path. 

25 

An effective cipher stream generator utilises secret key data to produce an output 
consisting of a pseudo random bit stream Z. The cipher stream Z is typically used to 
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encrypt a stream of message data by logically combining the cipher stream and the 
message stream. Since the cipher stream is continuously changing, a particular bit 
sequence repeated in the message stream will be encrypted differently each time, 
depending on the state of the cipher stream. It is therefore advantageous to exploit the 
5 time dependence randomness of the cipher stream not only for encryption of the message, 
but also to ensure that the integrity of the message is not compromised. Throughout the 
following description the terms message authenticity and message integrity are used 
interchangeably to refer to the condition of a digital message reaching its destination 
unaltered or, if altered, the alteration being detectable at the destination. In particular, 

10 the terms message authentication code (mac) and integrity check value (icv) are used 
interchangeably throughout the specification to denote a numerical value generated from 
the numerical value of a message which may be utilised to determine whether the 
message itself has been altered before reaching its destination* Furthermore, in the 
following for integers t and u we shall write t[u] to represent the unique positive integer 

15 satisfying: 

t[u\ s *(mod u) and 0*t[u}z(u-l) 



Consider a stream cipher with output Z = (zq, z u ...) where each output Z; is 
a word of w bits (typically w = 16 or 32), such that each Zj has a value from 0 to 2 W -1. 
It is assumed that Z is unpredictable in the sense that from any part of the Z stream it 

20 should be difficult to predict (either exactly or with high probability) what another part 
of the Z stream was or will be. The output of the cipher stream may be used to provide 
message integrity by the construction of an integrity check value (icv) that is generated 
from the message and appended thereto. A non-linear combination of the message and 
the stream cipher output is utilised to prevent an attacker from modifying the message 

25 and determining the necessary modification to generate a valid icv. Prime power modular 
arithmetic is also used in generating the icv, which ensures that the values of the icv are 
uniformly distributed and minimal in number for a given message value. The simplest 
icv can thus be calculated as follows, for a single message unit n^, such as a message 
word, and a prime modulus p: 



30 
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icv = (mfo + z x ) [p] 

Extending this to generate a single icv for two message units yields: 

icv = ((m 0 z a + m x z x ) + ^) [p] 



The preferred implementation of the integrity check value generation, however, 
involves generating a single icv for a message which consists of a sequence of message 
5 blocks each comprising a sequence of message integer units. 

The procedure for generating the icv is as follows: 
Select a message block length b and prime number p = 2 w +k (k small). Let a message 
string M = (mo, m l9 ...), of integers between 0 and 2 W -1 be partitioned into blocks Mq, 
Mj,..., Mg each containing at most b integers so that: 

10 

Mq = n^, m„..., iiVi 

Mj = m^., m N+1 ,..., m b0+1) .i, j = 0, 1,..., s-1 
M, = m^, m^j,..., m^p for some t * b-1 

15 Use the stream cipher to generate s+2 outputs Zj, z» u z^ 2 ,..., z^ g+1 . The icv is calculated 
as: 

icv(Af, b, p, z p z, +1 ,.~, z i ^ l ) 
-WWt/W'p W + » + -/(Af 5 , z^+z^M, (1) 

where for any message string N = (no, n^..., n T ), and integer x, 

flNjc) = (...((njc+n^x+n^x+^+n) x [p] (2) 
= (n a x r + n x x r ' 1 + n^t r ' 2 + .... +n,x) [p] 

The following example illustrates the procedure for generation of an icv for transmission 
with a message, such as over a telecommunications network. 

20 

Example 1: Let w = 32, p = 2 32 +15, d = 10, b = 20. Let the cipher be in state 56 (the 
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last output produced being z 55 ). Let M = (m^ m lf ..., m 10fi ) be a message string of length 
109 that requires integrity. M is divided into blocks Mq, M lf ..., M 4 of length 20 where 
H = (m^, m^,,..., M^jg), i = 0, 1,..., 4, and one block of 9 integers M 5 = (m 100 , 
m 101 ,..., m 108 ). The cipher is used to generate 7 outputs z^, z 57 , z^,..., z^, and the 
5 integrity check value is calculated according to (1) and (2). 

icv(A/, 20, 2** +15, z^ y Zj 7 , z^,..., 

The transmitted message is then 

As mentioned above, the strength of the message integrity or authentication checking 
system is preferably of the same order as the strength of the accompanying encryption 
system. In other words, the probability that an attacker is able to alter a message 
10 undetected should be comparable to the probability of the attacker successfully 
deciphering the message. The following Theorem and Corollaries establish a clear link 
between the strength of the integrity mechanism and the strength of the stream cipher 
from which it is constructed. 

15 Theorem: Let p = 2 w +k, and the function f be defined by (2). Let M and M' be any two 
unequal message strings of length b, and y any fixed integer. Then if x is a uniformly 
distributed random variable in the range 0 to 2 W -1, 

ProbabiUtylfLMjcy/tM'j) h y(mod p)U— 

2 W 

Proof: Let M = (m^ m^..., m^) and M' = (m'o, m',,..., m^i)- By expanding (2) 
Thus 

fLMjc) -AM's) = y(mod/>) 



20 



if and only if 

By a standard result of elementary number theory (see, for example, p58 of Ivan Niven 
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(m 0 - rtjx b +(m x - m' x )x b - l +...+(m b _ x - m' b _ x )x = y(mod p). 

and H.S. Zuckerman, The Theory of Numbers (fourth edition), John Wiley and Sons, 
1980) such an equivalence has at most b solutions for x, from which the result follows. 

Corollary 1 is an immediate consequence of this theorem. 

5 

Corollary 1: Let M and M' be any two unequal message strings, and y any fixed 
integer. Let the function icv() be defined as in (1) and (2). Then if Zj, z^, z^,..., z^ 5 are 
independent and uniformly distributed random variables in the range 0 to 2 w -l, 

Probability[icv(M, b 9 p 9 z p z^,..., z. +J+1 ) 

-icv(M f , b f p 9 z p z, +1 ,.», r^, +1 ) = ><mod p)]*— 

2 W 

Corollary 2 indicates the strength of the integrity mechanism in terms of the likelihood 
10 of replacing, in transit, a message and the corresponding icv with a legitimate, but 
different, message-icv pair. 

Corollary 2: Let M and M ! be any two unequal message strings, and y, g any fixed 
integers. Let the function icv() be defined as in (1) and (2). Then if Zj, z^ u z^,..., z^, 
15 are independent and uniformly distributed random variables in the range 0 to 2 W -1, 

Probability [icv(M b, p, z p z, +1 ,.„, ^ Xmod p) 

| icv(M, b, p 9 z p z, +1 ,..m Wi> 5 8( mod Pyi*\ (3) 

2 

Proof: Expanding the left hand side of the inequality above, 
Probability[icv(M', b, p, z p z^,..., z^, +1 ) = y(mod p) 

| icv(M, b, p, z p z,,,,..., z, wl ) = gimod />)] 



However 
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= Probability[icv(M, b, p, z p z, +1 ,..., z^^-icviM*, b, p y z p .^^j) 
s g - y(mod />) | icv(M, fc, />, z p z, +1 ,..., = #(mod />)]. 

fcv(A/, fc, />, z,, ZjJ-Mif, £>, />, z p z, +1 ,..., z^, +1 ) 

s CW„ ^VCAf,, ^ 1 )+...+XM r J . z< J-AM», z)+AM v ^-..--AM* z, J)(mod />) 
is independent of z^+j while 



Thus the events described in the conditional probability of (3) are independent and so the 
left hand side of (3) is equal to 

Probability[icv(M 9 b, p, z p z, + , +1 )-*cv(Af, b, /?, z p z^,.-., z,+s+l) 

- (g-;y)(mod />)]. 
5 The result now follows by Corollary 1. 

Assume that the stream cipher produces output that are independent and uniformly 
distributed random variables in the range 0 to 2 W -1. It follows from Corollary 2 that if 
any message and its integrity check value were to be altered in transit (the message being 

10 altered in at least one bit position), the new message and integrity check value would 
register as valid by the receiver with probability at most b/2 w . Thus we refer to log 2 
(2 w /b) as the effective icv size. As an example, with a word size w of 32 bits and a block 
size b of 20 the resulting effective icv size is approximately 28. Note that the effective 
icv size indicates the strength of the integrity method used with an idealised stream cipher 

15 (with outputs that are uniformly distributed independent random variables). For this to 
be a meaningful indicator of integrity strength with a practical deterministic stream cipher 



icv(M 9 b, />, z p z,- +1 ,. Zi+ M+1 ) = g (mod p) 



if and only if 
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however, clearly the stream cipher key size must be at least as large as the effective icv 
size. In this case if there is some way of altering or substituting message-icv pairs that 
goes undetected with a probability of more than b/2 w then this implies some 
corresponding level of predicability in the stream cipher output. 

Figure 1 illustrates a flow chart of the preferred method of generating an integrity 
check value (icv) or message authentication code (mac). The flow chart 2 begins with 
an initialisation step 4 in which the icv and indices j and k are initialised such that icv 
= 0, j = 0 and k = i, where i is the initial state of the stream cipher with output z. In 
order to determine the icv for a given message according to equations (1) and (2), the 
flow chart 2 is structured into a dual loop iterative process, wherein steps 6, 8, 12 and 
18 are used for the calculation of non linear function y (equation (2)) whilst steps 16, 20 
and 22 perform the steps necessary for the calculation of the icv according to equation 
(1). Step 6 acts as an initialisation step for the non linear function value y, such that the 
first iteration of steps 8 and 12 are effective to calculate the first term of equation (2) (ie: 
iiox). For each iteration of steps 8 and 12 successive integer values of the message are 
input from the message stream 10 and values of the stream cipher are input from cipher 
stream 14 according to the message block counter index k. Following each iteration of 
step 12 the index j is incremented by one, and a test of the value of index j is applied at 
step 16 to determine whether or not the last unit of the message has been processed. 
Where there remains message units left to process, the procedure continues to step 18 
where a test is applied to index j to determine whether or not the end of a message block 
has been reached. If j+1 is an integer divisor of block size b at step 18, this indicates 
that the beginning of a new message block has been reached, and the procedure continues 
to step 20 where the icv is incremented by the value of the non linear function y. The 
block counter index k is incremented following step 20, and the procedure passes to step 
6 where the non linear function y is reset. Where the beginning of a message block has 
not been reached at step 18 the procedure returns to step 8, so as to perform a further 
iteration of steps 8, 12 and 16. When the end of the message has been reached, as 
indicated by the result at step 16, the block counter index k is again incremented and the 
icv is totalled together with the final stream cipher value (step 22). Utilising this 
method allows the icv to be calculated in a serial manner, which is consistent with the 
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continuous output form of the message stream and cipher stream. 

The following describes a modification of the above described integrity system, 
to enable the effective icv size to be increased by any required factor h. As above, a 
5 message string M = (m^ m lr ..) is divided into blocks Mq, Mi,..., M, each containing at 
most b integers. The stream cipher is used to generate h(s+2) outputs Zj, z^, , 
Zi+Ms+^i' Then the integrity check value icv h is defined as a sequence of h integers 
between 0 and p calculated according to: 

icv k (M, b, p, z p z, + i»~* ^+*e+a>-i) 



10 

where the function f is given by (2). This provides an icv of length hp with an effective 
icv size of 




Thus, for example, if b = 20, w = 32, h = 4 then the effective icv size is 

4 (32 - log2 20)- 110.7 

To provide both integrity and encryption the cipher stream can be used to provide input 
15 to the integrity calculation as well as output to be used for message encryption. In order 
to prevent the integrity mechanism from being undermined by a known plain text attack 
it is important that cipher stream output that is used in icv calculations by the receiver 
never be used for message encryption by the sender. Otherwise a known plaintext attack 
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combined with altering the synchronisation of the cipher stream may succeed in making 
the receiver use cipher data in icv calculations which is known to an attacker. To 
overcome this problem an integer d (< b) is chosen such that only those Zj for which i 
is a multiple of d are used in the icv calculation, the remaining Zj being used for 
5 encryption. This technique is illustrated in the example below. 

Example 2: As in Example 1 let w = 32, p = 2 32 +15, d = 10, b = 20, M = (n^, m 1M .., 
m 108 ) and the cipher be in state 56. To apply integrity and confidentiality the cipher is 
used to generate 121 outputs z 56 , z 57 , z 58 ,..., z 176 , and the icv is calculated as, 

icv(M, 20, 2 32 +15, z^.., 

10 where the icv function is defined by (1) and (2). The transmitted message is 

K + Z56)[2 32 ], («! + Z57>[2 32 ],.», (/n 4 + z^P 32 ],..., (m 10g + z 176 )[2 32 ], icv. 

Figure 2 illustrates a simple block diagram of an encryption and integrity system 
which may be utilised to implement the above described. Message data nij is output from 
a message source 26, which message data is passed to both an encryption processor 30 

15 and a message authentication code generator 32. A cipher stream generator 28 outputs 
stream cipher data Zj, which also passes to both the encryption processor 30 and mac 
generator 32. The encryption processor 30 acts to combine the message and cipher 
stream data so as to encrypt the message for transmission thereof. Meanwhile, the mac 
generator 32 produces an integrity check value, as described above, utilising the same 

20 message data but only one of out every d cipher stream outputs, the other d-1 cipher 
stream outputs being utilised for encryption by the encryption processor 30. The 
encrypted message m'j and the icv are passed to a transmission source 34 whereat the icv 
is appended to the encrypted message for transmission on an output 36. 

25 The foregoing detailed description has been put forward merely by way of 

explanation only, and is not intended to be limiting to the invention, which is defined in 
the claims appended hereto. 
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GLOSSARY 

Z = pseudo-random cipher stream sequence of cipher strings Zj; 

5 Z; = cipher string word of w bits (Z; is an integer in the range 1 to (2 W -1)) 

M = digital message 

= (mo, m i9 m 2 , ) sequence of integer words in the range 0 to (2 W -1) 

= (Mo, Mj, MJ sequence of message blocks of length b, such that 

10 message length L * (s+1) b, where: 

Mo = % nip nVi 

= m bj , m bj+1 , m^,^, 

M, = m^, m^j, m^, for t s= (b-1) 

15 icv = integrity check value 

t[u] = t(mod u) 

p = 2 W + k (k small) such that p is prime 

f (N,x) = nox' + npc 1 * 1 + n^" 2 + ... + npc [p] 
20 = (...((noX + nj) x + n^ x + ... + n,) x [p] 

for N = n^ n : , n^ ... , ^ 
and integer word x 

icv (M, b, p, Z) = (f(Mo, ZJ + f(M u z^) + .... 
25 + f(M„ O + z^ 8+1 ) [p] 



WO 94/2106! 



PCT/AU94/00101 



- 16 - 

CLAIMS: 

1. A method for generating a message authentication code for a digital message in 
a telecommunications or computer system comprising: 
5 generating a sequence of pseudo random cipher strings; and 

generating a message authentication code by performing modular arithmetic to a 
prime modulus including multiplication of the digital message by a first said cipher string 
and addition of a second said cipher string. 

10 2. A method as claimed in claim 1, wherein the message comprises a sequence of 
message units which are multiplied by respective powers of said first cipher string in 
generating the message authentication code. 

3. A method as claimed in claim 1, wherein the message comprises a sequence of 
15 message blocks which are each multiplied by respective different first cipher strings in 

generating the message authentication code. 

4. A method as claimed in claim 2, wherein the message comprises a sequence of 
message blocks each comprising a said sequence of message units, each sequence of 

20 message units being multiplied by respective different said first cipher strings and 
summed with said second cipher string to form the message authentication code. 

5. A method as claimed in any preceding claim wherein a plurality of message 
authentication codes are generated for the same message but utilising different cipher 

25 strings, and the plurality of message authentication codes combined or concatenated to 
form a further message authentication code. 

6. A method for generating a message authentication code in a telecommunications 
or computer system for a digital message which comprises a sequence of message blocks 

30 each comprising a sequence of message units, including the steps of: 
generating a sequence of pseudo random cipher strings; 

generating a non-linear function value for each message block by summing the 
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constituent message units multiplied by respective values derived from said cipher string 
sequence; and 

generating the message authentication code by summing the non-linear function 
values with a said cipher string sequence value to a prime modulus. 

5 

7. A method as claimed in claim 6, wherein the message units are multiplied by 
respective powers of a said cipher string sequence value. 

8. A method as claimed in claim 6, wherein in generating each non-linear function 
10 value the message units are multiplied by respective powers of a said cipher stream 

sequence value, a different sequence value being utilised for each non-linear function 
value. 

9. A method as claimed in claim 8, wherein the cipher string sequence value 
15 summed with the non-linear function values to generate the message authentication code 

is a different sequence value from the cipher strings used to generate the non-linear 
function values. 

10. A method as claimed in any one of claims 6 to 9, wherein the non-linear function 
20 values, f, are generated according to: 

r 

/ (M,z) = E m z z\~ x (mod p) 

x-0 

where M is a message block comprising r message units m x (x=0,l,....,r), and Zj 
are said cipher string sequence values. 

11. A method for generating a message authentication code in a telecommunications 
25 or computer system for a digital message M which comprises a sequence of message 

units nij for j=0, 1, r, comprising the steps of: 

generating a sequence of pseudo random cipher strings 
determining a non-linear function value f according to 
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/ (M^p = 52 m Xi x ( mod />); ^ 

x-0 



generating the message authentication code Q modulus p, where p is prime, 
according to 

Q = (J{M^ + z, +1 ) (mod />) 



12. A method as claimed in claim 11, wherein the message is composed of a sequence 
of message blocks M k which each comprise a said sequence of message units, and 
wherein the message authentication code Q, modulus p, is generated according to: 



V*-o 



(mod p) 



13. A method for generating a message authentication code in a telecommunications 
or computer system for a digital message M which comprises a sequence of message 
10 units nij for j=0, 1, r, comprising the steps of: 

generating a sequence of pseudo random cipher strings Zj; 

determining a non-linear function value f according to 

r 

AM£) = £ mjL x (mod p) ; and 

Jt-0 

generating the message authentication code Q modulus p, where p is prime, 
according to 



<? = (flMj) + (mod p) 



15 



14. A method for generating a message authentication code in a telecommunications 
or computer system for a digital message M which comprises a sequence of message 
blocks for j=0, 1, s, each message block comprising a sequence of b message units 
m ik for k=0, 1, b-1, comprising the steps of: 
20 generating a sequence of cipher strings Zj, z» 2 . . . z^,; 
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determining a non-linear function value f for each message block according to 

fWp z ) = X) m jx Z ; X ( mod 

generating the message authentication code Q modulus p, where p is prime, 
according to 

<XM4> = <E AAf x ^ J + z,^,) (mod p). 

5 15. A method as claimed in claim 14, including the step of increasing the effective 
code size of the message authentication code by a factor of h by generating a modified 
message authentication code Q' according to: 

Q f = Q(Mx) 1 QiM^ 2 ) | QiM^J 

.... I <?(Af^ +(A _ 1>f+2 ) (mod p) 
where \ represents concatenation. 

16. A method as claimed in any one of claims 1, 6, 11, 13 or 14 wherein the sequence 
10 of cipher strings comprises a subset selection of cipher string values from a cipher 

stream. 

17. A method as claimed in claim 16 wherein the remaining cipher string values from 
the cipher stream are utilised for encrypting the message and/or the message 

15 authentication code. 

18. A method for encoding a digital message comprising generating a sequence of 
cipher strings, generating a message authentication code according to any one of claims 
1, 6, 11, 13 or 14, enciphering the message by combining at least one said cipher string 

20 therewith, the at least one cipher string being distinct from the cipher strings utilised for 
generating the message authentication code, and appending the message authentication 
code to the enciphered message. 
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19. Apparatus for generating a message authentication code for a digital message 

composed of a sequence of message blocks, comprising: 

a stream cipher for generating a sequence of pseudo-random cipher strings; and 
computation means for generating a non-linear function value for each message 
5 block by combining each message block with at least one said cipher string by way of 

modular arithmetic to a prime modulus, and generating a message authentication code by 

summing the non-linear function values together with at least one further said cipher 

string. 

10 20. Apparatus according to claim 19, including: 

encryption means for encrypting the message by utilising sequence values of said 
pseudo-random cipher string sequence which are distinct from the sequence values used 
to generate the message authentication code; and 

means for appending the message authentication code to the encrypted message 
15 for transmission thereof. 
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